1. Technical Field
This invention relates to portable data carriers such as IC cards, chip cards and smart cards and more particularly to security systems for controlling the authority of persons to access and change information contained in such cards.
2. Description of the Prior Art
U.S. Pat. No. 4,816,653 (Anderl et al.) teaches a file system for an IC card. The system has multiple levels of authorization controlling access to commands and data and password data protection contained in the header of each file. This system responds to read and write requests from the related workstation to provide or record data if the password and authority of the person at the workstation indicates that the person has the authority to perform the requested function. The interface to the IC card itself is not well defended in that surreptitious monitoring of the interface in an altered or counterfeit workstation will expose the passwords and other information as they are being transferred. There is no handshaking between the workstation and the IC card to detect counterfeit cards or workstations.
U.S. Pat. No. 5,048,085 (Abraham et al.) teaches a system having handshaking and other means to detect counterfeits. In this system, the users authority resides in user profiles that determine the functions that each user can perform and when they can be performed. In this system, a profile can be downloaded from another authenticated device in order to improve system flexibility. These features and others are used to advantage in the instant invention and the teachings described in this patent are hereby incorporated by reference into the instant specification.
U.S. Pat. No. 4,802,218 and 4,900,903 (Wright et al.) teach automated transaction systems exemplified as a postal metering systems that accommodates user cards, and supervisor cards for identifying persons and rate cards and master cards for storing data. The microprocessor in the card and the microprocessor in the postage printing station perform a handshake function to authenticate the card and the postage printing station
A more serious exposure of each of these prior art teachings is that the supervisors password is jeopardized when it requires wide distribution such as may be the case in a medical or social services application. For example, if all doctors who are to have access to information in the IC card must use the same password, there is a high likelihood that the password will become known to fraudulent persons who then are able to misuse the system.
U.S. Pat. No. 4,095,739 (Fox et al.) teaches a system for controlling access to a computer and a network of remote terminals. Users insert their ID card into a card reader at a remote terminal where the identification data is read and compared with data stored in a table of authorized users that is located either at the central computer or at each remote terminal. A supervisor who wishes to update the authorization table must insert a supervisor identification card containing supervisor identification data which is also compared with data stored in an authorization table.
U.S. Pat. No. 4,837,422 (Dethloff et al.) describes a multiple user card like that mentioned above where the authorized holder/user may further authorize subusers by entering subuser secret number identity verification data into the card. In this way the primary user need not divulge the primary secret number to anyone yet still allow another to use the card. Further limitations on extent and type of use are provided for. Again, since each subuser must be separately identified by the card, it becomes impossible to store in the card, all of the secret numbers that will be necessary for a health card for example to allow all of those health care workers who need access to a patients card data to have access without compromising the security of the card.
U.S. Pat. No. 5,010,237 (Kawana) teaches an IC card that stores a plurality of secret numbers which are compared with the numbers entered by authorized users. The comparison determines which functions are permitted during the transaction. For example comparison with a first PIN (secret number) allows the supervisor to read and write in the card but not to transmit. Comparison with the second PIN allows the manager to write and to transmit card data but not to read it.
U.S. Pat. No. 5,055,658 (Cockburn) teaches a security system wherein a master key in the form of a plastic memory card which allows the device being protected to be programmed to recognize similar slave keys and identification information such a thumb print in order to give the authorized slave key holder access to the device.
In this system like those described above, the comparison data for all users including supervisors must be stored in the devices to which access is being controlled. When those devices are computers or remote workstations, large amounts of memory are available but even then, only a limited number of supervisors are contemplated. When the device to be accessed is an IC card, it does not have adequate memory to store the data identifying each emergency room doctor that may need access to a patient's card in order to provide treatment.
As mentioned earlier, it is known to grant access to an IC card under an authorization profile by entering a secret number or PIN. When a large number of supervisors must access each card, the secret number must be shared by the supervisors which is not a secure arrangement. It is not practical to store each supervisor's PIN on each card because as new supervisors are added to the system or as a PIN is changed, all cards must be updated. In order that the PIN remain secure, each supervisor must enter the changed PIN into each card that has been issued. Not only will the supervisor be overwhelmed by the scale of the task but it will be impossible to get every cardholder to bring in their card to a specific person for update.
There is still another problem with sharing identity information among a number of supervisors. When biometric information such as thumb print, voice print, or signature dynamics are used to identify a supervisor, it can not by definition be shared by two or more persons. In summary, the needs not provided for in the prior art are that each supervisor must have their own PIN or biometric reference information, each supervisor must be able to update or change the information without recalling all cards that the supervisor may be required to access in the future, and security must be provided so that information captured while traveling through the system cannot compromise the security of other cards in the system.